GEODE-10543: Upgrade Log4j from 2.17.2 to 2.25.3 to remediate CVE-202… #7975
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…5-68161 - Updated log4j version to 2.25.3 in DependencyConstraints.groovy - Added log4j-core-test dependency for integration tests - Migrated integration test imports to new log4j-core-test package structure: * org.apache.logging.log4j.junit → org.apache.logging.log4j.core.test.junit * org.apache.logging.log4j.test → org.apache.logging.log4j.core.test - Added GraalVM annotation processor configuration to suppress compilation warnings - Updated documentation references to log4j 2.25.3 - Updated test resource files with new JAR versions All 21 integration tests migrated with zero logic changes. Build successful with all tests passing.
…o main compilation
The annotation processor options were being applied to all JavaCompile tasks including integration tests, where the Log4j GraalVM processor is not triggered. This caused compilation warnings about unrecognized processor options.
Changed from tasks.withType(JavaCompile) to tasks.named('compileJava') to restrict the configuration to main source compilation only.
…oSuchMethodError Log4j 2.25.3's log4j-core-test transitively depends on AssertJ 3.27.3, but Geode's custom AssertJ assertions (AbstractLogFileAssert) were built against AssertJ 3.22.0. The CommonValidations.failIfEmptySinceActualIsNotEmpty method signature changed between versions, causing NoSuchMethodError at runtime. Exclude assertj-core from log4j-core-test dependency to force usage of 3.22.0, ensuring binary compatibility with Geode's test infrastructure.
sboorlagadda
approved these changes
Jan 8, 2026
Member
sboorlagadda
left a comment
sboorlagadda
left a comment
There was a problem hiding this comment.
LGTM. @JinwooHwang can we verify that there are no other modules use log4j-core::tests or log4j-core::test-sources
Contributor
Author
|
@sboorlagadda, Thanks for the review! Verified!
./geode-log4j/build.gradle:84: // Log4j 2.20.0+ moved test utilities to log4j-core-test with new package names: All checks have passed. We're ready to merge! |
Member
|
Glad! good to go |
Contributor
Author
|
Thank you so much for your support @sboorlagadda . |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
GEODE-10543: Upgrade Log4j from 2.17.2 to 2.25.3
Description
This PR upgrades Apache Log4j from version 2.17.2 to 2.25.3 to remediate security vulnerability CVE-2025-68161.
Changes Made
1. Dependency Version Update
log4j.versionfrom2.17.2to2.25.3inDependencyConstraints.groovylog4j-core-testto dependency management for test utilities2. Build Configuration
geode-log4j/build.gradle-Alog4j.graalvm.groupIdand-Alog4j.graalvm.artifactId3. Integration Test Migration
org.apache.logging.log4j.junit.LoggerContextRule→org.apache.logging.log4j.core.test.junit.LoggerContextRuleorg.apache.logging.log4j.test.appender.ListAppender→org.apache.logging.log4j.core.test.appender.ListAppender4. Documentation Updates
geode-docs/managing/logging/configuring_log4j2.html.md.erbgeode-docs/managing/logging/how_logging_works.html.md.erbgeode-docs/tools_modules/http_session_mgmt/weblogic_setting_up_the_module.html.md.erb5. Test Resources
geode-all-bom/expected-pom.xmlwith 5 log4j dependency versionsFiles Changed
Testing
Security Impact
Related Issues
For all changes, please confirm:
develop)?gradlew buildrun cleanly?